Hitachi Energy RTU500 Product Uncontrolled Recursion (CVE-2024-8176)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505227);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/17");

  script_cve_id("CVE-2024-8176");
  script_xref(name:"ICSA", value:"26-062-03");

  script_name(english:"Hitachi Energy RTU500 Product Uncontrolled Recursion (CVE-2024-8176)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A stack overflow vulnerability exists in the libexpat library due to the way 
it handles recursive entity expansion in XML documents. 
When parsing an XML document with deeply nested entity references, 
libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. 
This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, 
depending on the environment and library usage. 
Product is only affected if IEC61850 functionality is configured.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://publisher.hitachienergy.com/preview?DocumentID=8DBD000237&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c424473c");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-03");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-8176");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(674);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:12");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.8.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:12");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.8.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:12");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.8.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:12");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.8.1");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:hitachienergy:rtu540_firmware:12" :
        {"versionEndIncluding" : "12.7.7", "versionStartIncluding" : "12.7.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.5" :
        {"versionEndIncluding" : "13.5.4", "versionStartIncluding" : "13.5.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.6" :
        {"versionEndIncluding" : "13.6.2", "versionStartIncluding" : "13.6.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.7" :
        {"versionEndExcluding" : "13.7.8", "versionStartIncluding" : "13.7.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.8.1" :
        {"versionEndIncluding" : "13.8.1", "versionStartIncluding" : "13.8.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:12" :
        {"versionEndIncluding" : "12.7.7", "versionStartIncluding" : "12.7.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.5" :
        {"versionEndIncluding" : "13.5.4", "versionStartIncluding" : "13.5.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.6" :
        {"versionEndIncluding" : "13.6.2", "versionStartIncluding" : "13.6.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.7" :
        {"versionEndExcluding" : "13.7.8", "versionStartIncluding" : "13.7.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.8.1" :
        {"versionEndIncluding" : "13.8.1", "versionStartIncluding" : "13.8.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:12" :
        {"versionEndIncluding" : "12.7.7", "versionStartIncluding" : "12.7.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.5" :
        {"versionEndIncluding" : "13.5.4", "versionStartIncluding" : "13.5.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.6" :
        {"versionEndIncluding" : "13.6.2", "versionStartIncluding" : "13.6.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.7" :
        {"versionEndExcluding" : "13.7.8", "versionStartIncluding" : "13.7.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.8.1" :
        {"versionEndIncluding" : "13.8.1", "versionStartIncluding" : "13.8.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:12" :
        {"versionEndIncluding" : "12.7.7", "versionStartIncluding" : "12.7.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.5" :
        {"versionEndIncluding" : "13.5.4", "versionStartIncluding" : "13.5.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.6" :
        {"versionEndIncluding" : "13.6.2", "versionStartIncluding" : "13.6.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.7" :
        {"versionEndExcluding" : "13.7.8", "versionStartIncluding" : "13.7.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.8.1" :
        {"versionEndIncluding" : "13.8.1", "versionStartIncluding" : "13.8.1", "family" : "AbbRTU500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);